+------------------------------------------------------------------------+
| Description | The ooh323 channel driver provided in Asterisk Addons |
| | used a TCP connection to pass commands internally. The |
| | payload of these packets included addresses of memory |
| | which were to be freed after the command was processed. |
| | By sending arbitrary data to the listening TCP socket, |
| | one could cause an almost certain crash since the |
| | command handler would attempt to free invalid memory. |
| | This problem was made worse by the fact that the |
| | listening TCP socket was bound to whatever IP address |
| | was specified by the "bindaddr" option in ooh323.conf |
+------------------------------------------------------------------------+

+------------------------------------------------------------------------+
| Resolution | The TCP connection used by ooh323 has been replaced with |
| | a pipe. The effect of this change is that data from |
| | outside the ooh323 process may not be injected. |
+------------------------------------------------------------------------+